forked from p15670423/monkey
Island: remove system_info processing file
No system info telemetries need to be processed anymore
This commit is contained in:
parent
5471e9854c
commit
73434537fe
|
@ -2,22 +2,22 @@ import logging
|
|||
|
||||
from common.common_consts.telem_categories import TelemCategoryEnum
|
||||
from monkey_island.cc.services.telemetry.processing.aws_info import process_aws_telemetry
|
||||
from monkey_island.cc.services.telemetry.processing.credentials.credentials_parser import\
|
||||
parse_credentials
|
||||
from monkey_island.cc.services.telemetry.processing.exploit import process_exploit_telemetry
|
||||
from monkey_island.cc.services.telemetry.processing.post_breach import process_post_breach_telemetry
|
||||
from monkey_island.cc.services.telemetry.processing.scan import process_scan_telemetry
|
||||
from monkey_island.cc.services.telemetry.processing.state import process_state_telemetry
|
||||
from monkey_island.cc.services.telemetry.processing.system_info import process_system_info_telemetry
|
||||
from monkey_island.cc.services.telemetry.processing.tunnel import process_tunnel_telemetry
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
TELEMETRY_CATEGORY_TO_PROCESSING_FUNC = {
|
||||
TelemCategoryEnum.CREDENTIALS: process_credentials_telemetry,
|
||||
TelemCategoryEnum.CREDENTIALS: parse_credentials,
|
||||
TelemCategoryEnum.TUNNEL: process_tunnel_telemetry,
|
||||
TelemCategoryEnum.STATE: process_state_telemetry,
|
||||
TelemCategoryEnum.EXPLOIT: process_exploit_telemetry,
|
||||
TelemCategoryEnum.SCAN: process_scan_telemetry,
|
||||
TelemCategoryEnum.SYSTEM_INFO: process_system_info_telemetry,
|
||||
TelemCategoryEnum.POST_BREACH: process_post_breach_telemetry,
|
||||
TelemCategoryEnum.AWS_INFO: process_aws_telemetry,
|
||||
# `lambda *args, **kwargs: None` is a no-op.
|
||||
|
|
|
@ -1,95 +0,0 @@
|
|||
import logging
|
||||
|
||||
from monkey_island.cc.server_utils.encryption import get_datastore_encryptor
|
||||
from monkey_island.cc.services.config import ConfigService
|
||||
from monkey_island.cc.services.telemetry.processing.system_info_collectors.system_info_telemetry_dispatcher import ( # noqa: E501
|
||||
SystemInfoTelemetryDispatcher,
|
||||
)
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
def process_system_info_telemetry(telemetry_json):
|
||||
dispatcher = SystemInfoTelemetryDispatcher()
|
||||
telemetry_processing_stages = [
|
||||
process_ssh_info,
|
||||
process_credential_info,
|
||||
dispatcher.dispatch_collector_results_to_relevant_processors,
|
||||
]
|
||||
|
||||
# Calling safe_process_telemetry so if one of the stages fail, we log and move on instead of
|
||||
# failing the rest of
|
||||
# them, as they are independent.
|
||||
for stage in telemetry_processing_stages:
|
||||
safe_process_telemetry(stage, telemetry_json)
|
||||
|
||||
|
||||
def safe_process_telemetry(processing_function, telemetry_json):
|
||||
# noinspection PyBroadException
|
||||
try:
|
||||
processing_function(telemetry_json)
|
||||
except Exception as err:
|
||||
logger.error(
|
||||
"Error {} while in {} stage of processing telemetry.".format(
|
||||
str(err), processing_function.__name__
|
||||
),
|
||||
exc_info=True,
|
||||
)
|
||||
|
||||
|
||||
def process_ssh_info(telemetry_json):
|
||||
if "ssh_info" in telemetry_json["data"]:
|
||||
ssh_info = telemetry_json["data"]["ssh_info"]
|
||||
encrypt_system_info_ssh_keys(ssh_info)
|
||||
if telemetry_json["data"]["network_info"]["networks"]:
|
||||
# We use user_name@machine_ip as the name of the ssh key stolen, thats why we need ip
|
||||
# from telemetry
|
||||
add_ip_to_ssh_keys(telemetry_json["data"]["network_info"]["networks"][0], ssh_info)
|
||||
add_system_info_ssh_keys_to_config(ssh_info)
|
||||
|
||||
|
||||
def add_system_info_ssh_keys_to_config(ssh_info):
|
||||
for user in ssh_info:
|
||||
ConfigService.creds_add_username(user["name"])
|
||||
# Public key is useless without private key
|
||||
if user["public_key"] and user["private_key"]:
|
||||
ConfigService.ssh_add_keys(
|
||||
user["public_key"], user["private_key"], user["name"], user["ip"]
|
||||
)
|
||||
|
||||
|
||||
def add_ip_to_ssh_keys(ip, ssh_info):
|
||||
for key in ssh_info:
|
||||
key["ip"] = ip["addr"]
|
||||
|
||||
|
||||
def encrypt_system_info_ssh_keys(ssh_info):
|
||||
for idx, user in enumerate(ssh_info):
|
||||
for field in ["public_key", "private_key", "known_hosts"]:
|
||||
if ssh_info[idx][field]:
|
||||
ssh_info[idx][field] = get_datastore_encryptor().encrypt(ssh_info[idx][field])
|
||||
|
||||
|
||||
def process_credential_info(telemetry_json):
|
||||
if "credentials" in telemetry_json["data"]:
|
||||
creds = telemetry_json["data"]["credentials"]
|
||||
add_system_info_creds_to_config(creds)
|
||||
replace_user_dot_with_comma(creds)
|
||||
|
||||
|
||||
def replace_user_dot_with_comma(creds):
|
||||
for user in creds:
|
||||
if -1 != user.find("."):
|
||||
new_user = user.replace(".", ",")
|
||||
creds[new_user] = creds.pop(user)
|
||||
|
||||
|
||||
def add_system_info_creds_to_config(creds):
|
||||
for user in creds:
|
||||
ConfigService.creds_add_username(creds[user]["username"])
|
||||
if "password" in creds[user] and creds[user]["password"]:
|
||||
ConfigService.creds_add_password(creds[user]["password"])
|
||||
if "lm_hash" in creds[user] and creds[user]["lm_hash"]:
|
||||
ConfigService.creds_add_lm_hash(creds[user]["lm_hash"])
|
||||
if "ntlm_hash" in creds[user] and creds[user]["ntlm_hash"]:
|
||||
ConfigService.creds_add_ntlm_hash(creds[user]["ntlm_hash"])
|
Loading…
Reference in New Issue